Perhaps your email software is configured to allow relaying - it is an open relay?
Relaying allows any person anywhere on the Internet to send email with any "from" email address to your server and have your server deliver it to any number of recipients anywhere in the internet with any "to" address.
You should really restrict this to reject all mail other than two distinct patterns:
mail from the outside, with a "to" address that includes your domain name and where the part before the at symbol matches a defined person within your organisation. In the case of a web-server this might be no-one if the web-server has no need to accept incoming email. Often an organisation will have separate email servers to handle email for it's members.
mail from authenticated users with a from address that includes your domain name. In this case the to address can be anything. The senders are normally sending from IP-addresses within your local network but it can be useful to allow trusted people to use your email server - in that case they must be authenticated before allowing email transmission.
If you do this, you wont be propagating SPAM for spammers (and risk getting blacklisted) but it will have no effect on your legitimate activities.
Before and after changing the configuration of your email server, test it. Use an unrelated Internet access point (3G, Internet cafe, home) to try to send email through your mail server, try various combinations of to and from addresses
From To Expect
genuine@mydomain email@example.com allowed
firstname.lastname@example.org email@example.com rejected
fakester@mydomain firstname.lastname@example.org rejected
genuine@mydomain email@example.com allowed only if authenticated
But most web-servers don't need to send mail outside the server, other than maybe to webmasters/administrators. SO they can be locked down tighter.